Hi,  We are going back and forth with Splunk support on an error coming from your automatic lookup as we can't seem to correct this from our end (no edit option on Splunk Cloud web console). And we need your help in fixing this. This error shows up when we run some correlation searches. x-------------------------Start of ERROR---------------------------------x Cannot expand lookup field 'severity' due to a reference cycle in the lookup configuration. Check search.log for details and update the lookup configuration to remove the reference cycle. x-------------------------End of ERROR----------------------------------x This error happens if one field is present in both input and output field in an automatic lookup. Splunk is saying the error is generating from "arista_switch_log : LOOKUP-syslogseverity" automatic lookup. The configs in this lookup needs to be corrected by removing the severity field from the output field. Current settings: syslogseverity severity OUTPUTNEW severity severity_desc Recommended settings by Splunk to avoid reference cycle error: syslogseverity severity OUTPUTNEW severity_desc Please assist. ... View more

Hi, we are using a Splunk Cloud ES and we can't seem to edit the base search macro of the "Alerts" datamodel. The macro in question is, " cim_Alerts_indexes" and it appears it has an extra parameter which generates an error when this macro is ran manually. Error: "Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side" And that is due to the fact that the macro SPL is set up as follows:   (index=(index=azure_security sourcetype="GraphSecurityAlert") OR (index=trendmicro))     The extra "index=" in the beginning is what's messing it up. It should be removed. However, when we try to go to Settings -> Advanced Search and click on this macro, we are taken to the CIM Setup interface (Splunk_SA_CIM) which shows the config settings of the macro, including the:   Indexes whitelist = azure_security,trendmicro Tags whitelist = cloud, pci   Notice, the editable configs do not include the definition which is:   (index=(index=azure_security sourcetype="GraphSecurityAlert") OR (index=trendmicro))     So can anyone assist how we can correct this? Regards   ... View more